emdash 1.1.0 → 1.2.0

package/dist/canonical-Y1dpjCnp.mjs

@@ -1,174 +0,0 @@
-//#region src/transfer/format/limits.ts
-/**
-* Hard limits for site packages and transfer operations.
-*
-* Package limits are part of the format contract: an exporter must never
-* produce a package that exceeds them and a reader must reject one that does
-* before doing expensive work. Operation limits bound one `advance` step so it
-* fits a Workers request on D1.
-*/
-const MiB = 1024 * 1024;
-const TRANSFER_LIMITS = Object.freeze({
-	manifestBytes: 8 * MiB,
-	recordLineBytes: 19e5,
-	chunkBytes: 4 * MiB,
-	chunkRecords: 1e3,
-	totalRecords: 5e6,
-	jsonDepth: 64,
-	totalFiles: 1e6,
-	indexChunks: 1e3,
-	defaultMaxBlobBytes: 50 * MiB,
-	idLength: 1024,
-	shortString: 4096,
-	stepQueryCeiling: 900,
-	stepQueries: 150,
-	stepClosingQueries: 2,
-	stepBytes: 32 * MiB,
-	d1BindParameters: 100,
-	leaseSeconds: 300,
-	pendingImportTtlSeconds: 1440 * 60,
-	exportTtlSeconds: 10080 * 60,
-	approvalTtlSeconds: 900,
-	exportFenceAttempts: 3,
-	verificationMismatches: 50,
-	planIssues: 500
-});
-/**
-* Rows per multi-row INSERT so a statement stays within D1's bound-parameter
-* limit. Returns 0 when a single row needs more parameters than the limit;
-* callers then insert core columns first and set the rest with batched
-* UPDATEs.
-*/
-function rowsPerInsert(columnCount) {
-	if (!Number.isInteger(columnCount) || columnCount < 1) throw new RangeError(`Invalid column count ${columnCount}`);
-	return Math.floor(TRANSFER_LIMITS.d1BindParameters / columnCount);
-}
-
-//#endregion
-//#region src/transfer/format/canonical.ts
-/**
-* Canonical JSON serialization for site packages.
-*
-* Rules (normative for formatVersion "1"):
-* - object keys are sorted by UTF-16 code unit order ({@link compareUtf16});
-* - no insignificant whitespace;
-* - strings and numbers are encoded exactly as `JSON.stringify` encodes them;
-* - object properties whose value is `undefined` are omitted;
-* - `undefined` inside an array, non-finite numbers, and any value that is not
-*   a plain object, array, string, finite number, boolean, or `null` are
-*   rejected;
-* - nesting depth is at most {@link TRANSFER_LIMITS.jsonDepth} containers
-*   (the root object or array is depth 1).
-*
-* The manifest, every NDJSON line, the plan, the receipt, and logical digests
-* all use this one implementation.
-*/
-var CanonicalJsonError = class extends Error {
-	path;
-	constructor(message, path) {
-		super(`${message} at ${path}`);
-		this.name = "CanonicalJsonError";
-		this.path = path;
-	}
-};
-function compareUtf16(a, b) {
-	if (a === b) return 0;
-	return a < b ? -1 : 1;
-}
-function canonicalJson(value, options = {}) {
-	const maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;
-	const parts = [];
-	write(value, parts, 0, maxDepth, "$");
-	return parts.join("");
-}
-function write(value, out, depth, maxDepth, path) {
-	if (value === null) {
-		out.push("null");
-		return;
-	}
-	switch (typeof value) {
-		case "string":
-			out.push(JSON.stringify(value));
-			return;
-		case "number":
-			if (!Number.isFinite(value)) throw new CanonicalJsonError("Non-finite number", path);
-			out.push(JSON.stringify(value));
-			return;
-		case "boolean":
-			out.push(value ? "true" : "false");
-			return;
-		case "object": break;
-		default: throw new CanonicalJsonError(`Unsupported ${typeof value} value`, path);
-	}
-	if (depth + 1 > maxDepth) throw new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, path);
-	if (Array.isArray(value)) {
-		out.push("[");
-		for (let index = 0; index < value.length; index++) {
-			if (index > 0) out.push(",");
-			const item = value[index];
-			if (item === void 0) throw new CanonicalJsonError("Undefined array item", `${path}[${index}]`);
-			write(item, out, depth + 1, maxDepth, `${path}[${index}]`);
-		}
-		out.push("]");
-		return;
-	}
-	const prototype = Object.getPrototypeOf(value);
-	if (prototype !== Object.prototype && prototype !== null) throw new CanonicalJsonError("Non-plain object", path);
-	const present = Object.entries(value).filter(([, item]) => item !== void 0).toSorted(([a], [b]) => compareUtf16(a, b));
-	out.push("{");
-	present.forEach(([key, item], index) => {
-		if (index > 0) out.push(",");
-		out.push(JSON.stringify(key), ":");
-		write(item, out, depth + 1, maxDepth, `${path}.${key}`);
-	});
-	out.push("}");
-}
-/**
-* Container nesting depth of a JSON text, measured without parsing it so an
-* adversarial document cannot exhaust the parser's stack first. Returns
-* `Infinity` as soon as `limit` is exceeded.
-*/
-function measureJsonDepth(text, limit = TRANSFER_LIMITS.jsonDepth) {
-	let depth = 0;
-	let max = 0;
-	let inString = false;
-	for (let index = 0; index < text.length; index++) {
-		const code = text.charCodeAt(index);
-		if (inString) {
-			if (code === 92) index++;
-			else if (code === 34) inString = false;
-			continue;
-		}
-		if (code === 34) inString = true;
-		else if (code === 123 || code === 91) {
-			depth++;
-			if (depth > max) {
-				max = depth;
-				if (max > limit) return Number.POSITIVE_INFINITY;
-			}
-		} else if (code === 125 || code === 93) depth--;
-	}
-	return max;
-}
-/**
-* Parse a JSON text that must already be in canonical form. Throws
-* {@link CanonicalJsonError} when the depth limit is exceeded, the text is not
-* valid JSON, or re-serializing the parsed value does not reproduce the text
-* byte for byte.
-*/
-function parseCanonicalJson(text, options = {}) {
-	const maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;
-	if (measureJsonDepth(text, maxDepth) > maxDepth) throw new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, "$");
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch {
-		throw new CanonicalJsonError("Invalid JSON", "$");
-	}
-	if (canonicalJson(parsed, { maxDepth }) !== text) throw new CanonicalJsonError("JSON is not in canonical form", "$");
-	return parsed;
-}
-
-//#endregion
-export { parseCanonicalJson as a, measureJsonDepth as i, canonicalJson as n, TRANSFER_LIMITS as o, compareUtf16 as r, rowsPerInsert as s, CanonicalJsonError as t };
-//# sourceMappingURL=canonical-Y1dpjCnp.mjs.map

package/dist/canonical-Y1dpjCnp.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical-Y1dpjCnp.mjs","names":[],"sources":["../src/transfer/format/limits.ts","../src/transfer/format/canonical.ts"],"sourcesContent":["/**\n * Hard limits for site packages and transfer operations.\n *\n * Package limits are part of the format contract: an exporter must never\n * produce a package that exceeds them and a reader must reject one that does\n * before doing expensive work. Operation limits bound one `advance` step so it\n * fits a Workers request on D1.\n */\n\nconst MiB = 1024 * 1024;\n\nexport const TRANSFER_LIMITS = Object.freeze({\n\t/** Maximum `manifest.json` size in bytes. */\n\tmanifestBytes: 8 * MiB,\n\t/**\n\t * Maximum bytes in one NDJSON line, excluding the newline. Kept under D1's\n\t * 2 MB row/statement ceiling so every record can be written in one row.\n\t */\n\trecordLineBytes: 1_900_000,\n\t/** Maximum bytes in one record or index chunk file. */\n\tchunkBytes: 4 * MiB,\n\t/** Maximum records (or index entries) in one chunk file. */\n\tchunkRecords: 1000,\n\t/** Maximum records across every kind. */\n\ttotalRecords: 5_000_000,\n\t/** Maximum container nesting of any JSON value (root = 1). */\n\tjsonDepth: 64,\n\t/** Maximum files (record chunks + media blobs) listed by the index. */\n\ttotalFiles: 1_000_000,\n\t/** Maximum index chunk files listed by the manifest. */\n\tindexChunks: 1000,\n\t/** Default per-blob ceiling; the target's `maxUploadSize` overrides it. */\n\tdefaultMaxBlobBytes: 50 * MiB,\n\n\t/** Maximum length of a portable id (including synthetic composite ids). */\n\tidLength: 1024,\n\t/** Maximum length of short strings: slugs, names, labels, locales, mime types. */\n\tshortString: 4096,\n\n\t/** Operation step: stop starting work once this many queries ran in the request. */\n\tstepQueryCeiling: 900,\n\t/** Operation step: queries a unit of work may use; checked before starting it. */\n\tstepQueries: 150,\n\t/**\n\t * Operation step: queries kept back from the ceiling for the writes that\n\t * end a step once no more units start (a checkpoint and the lease\n\t * release, or the read and write that record a failed step).\n\t */\n\tstepClosingQueries: 2,\n\t/** Operation step: media bytes copied per step (a larger single blob gets its own step). */\n\tstepBytes: 32 * MiB,\n\t/** D1 bound parameters per statement. */\n\td1BindParameters: 100,\n\n\t/** Operation lease duration. */\n\tleaseSeconds: 5 * 60,\n\t/** Uploading / analyzing / planned imports expire after this long. */\n\tpendingImportTtlSeconds: 24 * 60 * 60,\n\t/** Completed exports expire (and their staging is collected) after this long. */\n\texportTtlSeconds: 7 * 24 * 60 * 60,\n\t/**\n\t * MCP approval grant lifetime: a pending grant expires this long after it\n\t * is requested, and an approved one this long after it is approved.\n\t */\n\tapprovalTtlSeconds: 15 * 60,\n\t/** Export attempts before failing with TRANSFER_EXPORT_CONCURRENT_WRITES. */\n\texportFenceAttempts: 3,\n\t/** Maximum mismatches kept in a verification failure detail. */\n\tverificationMismatches: 50,\n\t/** Maximum warnings or blockers kept in a plan (the rest are summarized by count). */\n\tplanIssues: 500,\n});\n\nexport type TransferLimits = typeof TRANSFER_LIMITS;\n\n/**\n * Rows per multi-row INSERT so a statement stays within D1's bound-parameter\n * limit. Returns 0 when a single row needs more parameters than the limit;\n * callers then insert core columns first and set the rest with batched\n * UPDATEs.\n */\nexport function rowsPerInsert(columnCount: number): number {\n\tif (!Number.isInteger(columnCount) || columnCount < 1) {\n\t\tthrow new RangeError(`Invalid column count ${columnCount}`);\n\t}\n\treturn Math.floor(TRANSFER_LIMITS.d1BindParameters / columnCount);\n}\n","/**\n * Canonical JSON serialization for site packages.\n *\n * Rules (normative for formatVersion \"1\"):\n * - object keys are sorted by UTF-16 code unit order ({@link compareUtf16});\n * - no insignificant whitespace;\n * - strings and numbers are encoded exactly as `JSON.stringify` encodes them;\n * - object properties whose value is `undefined` are omitted;\n * - `undefined` inside an array, non-finite numbers, and any value that is not\n *   a plain object, array, string, finite number, boolean, or `null` are\n *   rejected;\n * - nesting depth is at most {@link TRANSFER_LIMITS.jsonDepth} containers\n *   (the root object or array is depth 1).\n *\n * The manifest, every NDJSON line, the plan, the receipt, and logical digests\n * all use this one implementation.\n */\n\nimport { TRANSFER_LIMITS } from \"./limits.js\";\n\nexport class CanonicalJsonError extends Error {\n\treadonly path: string;\n\n\tconstructor(message: string, path: string) {\n\t\tsuper(`${message} at ${path}`);\n\t\tthis.name = \"CanonicalJsonError\";\n\t\tthis.path = path;\n\t}\n}\n\nexport type JsonPrimitive = string | number | boolean | null;\nexport type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };\n\nexport function compareUtf16(a: string, b: string): number {\n\tif (a === b) return 0;\n\treturn a < b ? -1 : 1;\n}\n\nexport function canonicalJson(value: unknown, options: { maxDepth?: number } = {}): string {\n\tconst maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;\n\tconst parts: string[] = [];\n\twrite(value, parts, 0, maxDepth, \"$\");\n\treturn parts.join(\"\");\n}\n\nfunction write(value: unknown, out: string[], depth: number, maxDepth: number, path: string): void {\n\tif (value === null) {\n\t\tout.push(\"null\");\n\t\treturn;\n\t}\n\tswitch (typeof value) {\n\t\tcase \"string\":\n\t\t\tout.push(JSON.stringify(value));\n\t\t\treturn;\n\t\tcase \"number\":\n\t\t\tif (!Number.isFinite(value)) throw new CanonicalJsonError(\"Non-finite number\", path);\n\t\t\tout.push(JSON.stringify(value));\n\t\t\treturn;\n\t\tcase \"boolean\":\n\t\t\tout.push(value ? \"true\" : \"false\");\n\t\t\treturn;\n\t\tcase \"object\":\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tthrow new CanonicalJsonError(`Unsupported ${typeof value} value`, path);\n\t}\n\n\tif (depth + 1 > maxDepth) {\n\t\tthrow new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, path);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\tout.push(\"[\");\n\t\tfor (let index = 0; index < value.length; index++) {\n\t\t\tif (index > 0) out.push(\",\");\n\t\t\tconst item: unknown = value[index];\n\t\t\tif (item === undefined)\n\t\t\t\tthrow new CanonicalJsonError(\"Undefined array item\", `${path}[${index}]`);\n\t\t\twrite(item, out, depth + 1, maxDepth, `${path}[${index}]`);\n\t\t}\n\t\tout.push(\"]\");\n\t\treturn;\n\t}\n\n\tconst prototype: unknown = Object.getPrototypeOf(value);\n\tif (prototype !== Object.prototype && prototype !== null) {\n\t\tthrow new CanonicalJsonError(\"Non-plain object\", path);\n\t}\n\tconst entries: Array<[string, unknown]> = Object.entries(value);\n\tconst present = entries\n\t\t.filter(([, item]) => item !== undefined)\n\t\t.toSorted(([a], [b]) => compareUtf16(a, b));\n\tout.push(\"{\");\n\tpresent.forEach(([key, item], index) => {\n\t\tif (index > 0) out.push(\",\");\n\t\tout.push(JSON.stringify(key), \":\");\n\t\twrite(item, out, depth + 1, maxDepth, `${path}.${key}`);\n\t});\n\tout.push(\"}\");\n}\n\n/**\n * Container nesting depth of a JSON text, measured without parsing it so an\n * adversarial document cannot exhaust the parser's stack first. Returns\n * `Infinity` as soon as `limit` is exceeded.\n */\nexport function measureJsonDepth(text: string, limit: number = TRANSFER_LIMITS.jsonDepth): number {\n\tlet depth = 0;\n\tlet max = 0;\n\tlet inString = false;\n\tfor (let index = 0; index < text.length; index++) {\n\t\tconst code = text.charCodeAt(index);\n\t\tif (inString) {\n\t\t\tif (code === 0x5c) index++;\n\t\t\telse if (code === 0x22) inString = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (code === 0x22) inString = true;\n\t\telse if (code === 0x7b || code === 0x5b) {\n\t\t\tdepth++;\n\t\t\tif (depth > max) {\n\t\t\t\tmax = depth;\n\t\t\t\tif (max > limit) return Number.POSITIVE_INFINITY;\n\t\t\t}\n\t\t} else if (code === 0x7d || code === 0x5d) depth--;\n\t}\n\treturn max;\n}\n\n/**\n * Parse a JSON text that must already be in canonical form. Throws\n * {@link CanonicalJsonError} when the depth limit is exceeded, the text is not\n * valid JSON, or re-serializing the parsed value does not reproduce the text\n * byte for byte.\n */\nexport function parseCanonicalJson(text: string, options: { maxDepth?: number } = {}): unknown {\n\tconst maxDepth = options.maxDepth ?? TRANSFER_LIMITS.jsonDepth;\n\tif (measureJsonDepth(text, maxDepth) > maxDepth) {\n\t\tthrow new CanonicalJsonError(`Nesting deeper than ${maxDepth}`, \"$\");\n\t}\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new CanonicalJsonError(\"Invalid JSON\", \"$\");\n\t}\n\tif (canonicalJson(parsed, { maxDepth }) !== text) {\n\t\tthrow new CanonicalJsonError(\"JSON is not in canonical form\", \"$\");\n\t}\n\treturn parsed;\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,MAAM,OAAO;AAEnB,MAAa,kBAAkB,OAAO,OAAO;CAE5C,eAAe,IAAI;CAKnB,iBAAiB;CAEjB,YAAY,IAAI;CAEhB,cAAc;CAEd,cAAc;CAEd,WAAW;CAEX,YAAY;CAEZ,aAAa;CAEb,qBAAqB,KAAK;CAG1B,UAAU;CAEV,aAAa;CAGb,kBAAkB;CAElB,aAAa;CAMb,oBAAoB;CAEpB,WAAW,KAAK;CAEhB,kBAAkB;CAGlB,cAAc;CAEd,yBAAyB,OAAU;CAEnC,kBAAkB,QAAc;CAKhC,oBAAoB;CAEpB,qBAAqB;CAErB,wBAAwB;CAExB,YAAY;CACZ,CAAC;;;;;;;AAUF,SAAgB,cAAc,aAA6B;AAC1D,KAAI,CAAC,OAAO,UAAU,YAAY,IAAI,cAAc,EACnD,OAAM,IAAI,WAAW,wBAAwB,cAAc;AAE5D,QAAO,KAAK,MAAM,gBAAgB,mBAAmB,YAAY;;;;;;;;;;;;;;;;;;;;;;ACjElE,IAAa,qBAAb,cAAwC,MAAM;CAC7C,AAAS;CAET,YAAY,SAAiB,MAAc;AAC1C,QAAM,GAAG,QAAQ,MAAM,OAAO;AAC9B,OAAK,OAAO;AACZ,OAAK,OAAO;;;AAOd,SAAgB,aAAa,GAAW,GAAmB;AAC1D,KAAI,MAAM,EAAG,QAAO;AACpB,QAAO,IAAI,IAAI,KAAK;;AAGrB,SAAgB,cAAc,OAAgB,UAAiC,EAAE,EAAU;CAC1F,MAAM,WAAW,QAAQ,YAAY,gBAAgB;CACrD,MAAM,QAAkB,EAAE;AAC1B,OAAM,OAAO,OAAO,GAAG,UAAU,IAAI;AACrC,QAAO,MAAM,KAAK,GAAG;;AAGtB,SAAS,MAAM,OAAgB,KAAe,OAAe,UAAkB,MAAoB;AAClG,KAAI,UAAU,MAAM;AACnB,MAAI,KAAK,OAAO;AAChB;;AAED,SAAQ,OAAO,OAAf;EACC,KAAK;AACJ,OAAI,KAAK,KAAK,UAAU,MAAM,CAAC;AAC/B;EACD,KAAK;AACJ,OAAI,CAAC,OAAO,SAAS,MAAM,CAAE,OAAM,IAAI,mBAAmB,qBAAqB,KAAK;AACpF,OAAI,KAAK,KAAK,UAAU,MAAM,CAAC;AAC/B;EACD,KAAK;AACJ,OAAI,KAAK,QAAQ,SAAS,QAAQ;AAClC;EACD,KAAK,SACJ;EACD,QACC,OAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM,SAAS,KAAK;;AAGzE,KAAI,QAAQ,IAAI,SACf,OAAM,IAAI,mBAAmB,uBAAuB,YAAY,KAAK;AAGtE,KAAI,MAAM,QAAQ,MAAM,EAAE;AACzB,MAAI,KAAK,IAAI;AACb,OAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AAClD,OAAI,QAAQ,EAAG,KAAI,KAAK,IAAI;GAC5B,MAAM,OAAgB,MAAM;AAC5B,OAAI,SAAS,OACZ,OAAM,IAAI,mBAAmB,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG;AAC1E,SAAM,MAAM,KAAK,QAAQ,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG;;AAE3D,MAAI,KAAK,IAAI;AACb;;CAGD,MAAM,YAAqB,OAAO,eAAe,MAAM;AACvD,KAAI,cAAc,OAAO,aAAa,cAAc,KACnD,OAAM,IAAI,mBAAmB,oBAAoB,KAAK;CAGvD,MAAM,UADoC,OAAO,QAAQ,MAAM,CAE7D,QAAQ,GAAG,UAAU,SAAS,OAAU,CACxC,UAAU,CAAC,IAAI,CAAC,OAAO,aAAa,GAAG,EAAE,CAAC;AAC5C,KAAI,KAAK,IAAI;AACb,SAAQ,SAAS,CAAC,KAAK,OAAO,UAAU;AACvC,MAAI,QAAQ,EAAG,KAAI,KAAK,IAAI;AAC5B,MAAI,KAAK,KAAK,UAAU,IAAI,EAAE,IAAI;AAClC,QAAM,MAAM,KAAK,QAAQ,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM;GACtD;AACF,KAAI,KAAK,IAAI;;;;;;;AAQd,SAAgB,iBAAiB,MAAc,QAAgB,gBAAgB,WAAmB;CACjG,IAAI,QAAQ;CACZ,IAAI,MAAM;CACV,IAAI,WAAW;AACf,MAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EACjD,MAAM,OAAO,KAAK,WAAW,MAAM;AACnC,MAAI,UAAU;AACb,OAAI,SAAS,GAAM;YACV,SAAS,GAAM,YAAW;AACnC;;AAED,MAAI,SAAS,GAAM,YAAW;WACrB,SAAS,OAAQ,SAAS,IAAM;AACxC;AACA,OAAI,QAAQ,KAAK;AAChB,UAAM;AACN,QAAI,MAAM,MAAO,QAAO,OAAO;;aAEtB,SAAS,OAAQ,SAAS,GAAM;;AAE5C,QAAO;;;;;;;;AASR,SAAgB,mBAAmB,MAAc,UAAiC,EAAE,EAAW;CAC9F,MAAM,WAAW,QAAQ,YAAY,gBAAgB;AACrD,KAAI,iBAAiB,MAAM,SAAS,GAAG,SACtC,OAAM,IAAI,mBAAmB,uBAAuB,YAAY,IAAI;CAErE,IAAI;AACJ,KAAI;AACH,WAAS,KAAK,MAAM,KAAK;SAClB;AACP,QAAM,IAAI,mBAAmB,gBAAgB,IAAI;;AAElD,KAAI,cAAc,QAAQ,EAAE,UAAU,CAAC,KAAK,KAC3C,OAAM,IAAI,mBAAmB,iCAAiC,IAAI;AAEnE,QAAO"}

package/dist/challenge-store-CxZxPqaw.mjs

@@ -1,51 +0,0 @@
-//#region src/auth/challenge-store.ts
-function createChallengeStore(db) {
-	return {
-		async set(challenge, data) {
-			const expiresAt = new Date(data.expiresAt).toISOString();
-			await db.insertInto("auth_challenges").values({
-				challenge,
-				type: data.type,
-				user_id: data.userId ?? null,
-				data: data.context ?? null,
-				expires_at: expiresAt
-			}).onConflict((oc) => oc.column("challenge").doUpdateSet({
-				type: data.type,
-				user_id: data.userId ?? null,
-				data: data.context ?? null,
-				expires_at: expiresAt
-			})).execute();
-		},
-		async get(challenge) {
-			const row = await db.selectFrom("auth_challenges").selectAll().where("challenge", "=", challenge).executeTakeFirst();
-			if (!row) return null;
-			const expiresAt = new Date(row.expires_at).getTime();
-			if (expiresAt < Date.now()) {
-				await this.delete(challenge);
-				return null;
-			}
-			return {
-				type: row.type === "registration" ? "registration" : "authentication",
-				userId: row.user_id ?? void 0,
-				expiresAt,
-				...row.data === null ? {} : { context: row.data }
-			};
-		},
-		async delete(challenge) {
-			await db.deleteFrom("auth_challenges").where("challenge", "=", challenge).execute();
-		}
-	};
-}
-/**
-* Clean up expired challenges.
-* Should be called periodically (e.g., on startup, or via cron).
-*/
-async function cleanupExpiredChallenges(db) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const result = await db.deleteFrom("auth_challenges").where("expires_at", "<", now).executeTakeFirst();
-	return Number(result.numDeletedRows ?? 0);
-}
-
-//#endregion
-export { createChallengeStore as n, cleanupExpiredChallenges as t };
-//# sourceMappingURL=challenge-store-CxZxPqaw.mjs.map

package/dist/challenge-store-CxZxPqaw.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"challenge-store-CxZxPqaw.mjs","names":[],"sources":["../src/auth/challenge-store.ts"],"sourcesContent":["/**\n * Challenge store for WebAuthn\n *\n * Stores WebAuthn challenges in a dedicated table with automatic expiration.\n */\n\nimport type { ChallengeStore, ChallengeData } from \"@emdash-cms/auth/passkey\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../database/types.js\";\n\nexport function createChallengeStore(db: Kysely<Database>): ChallengeStore {\n\treturn {\n\t\tasync set(challenge: string, data: ChallengeData): Promise<void> {\n\t\t\tconst expiresAt = new Date(data.expiresAt).toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"auth_challenges\")\n\t\t\t\t.values({\n\t\t\t\t\tchallenge,\n\t\t\t\t\ttype: data.type,\n\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\tdata: data.context ?? null,\n\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t})\n\t\t\t\t.onConflict((oc) =>\n\t\t\t\t\toc.column(\"challenge\").doUpdateSet({\n\t\t\t\t\t\ttype: data.type,\n\t\t\t\t\t\tuser_id: data.userId ?? null,\n\t\t\t\t\t\tdata: data.context ?? null,\n\t\t\t\t\t\texpires_at: expiresAt,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t},\n\n\t\tasync get(challenge: string): Promise<ChallengeData | null> {\n\t\t\tconst row = await db\n\t\t\t\t.selectFrom(\"auth_challenges\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"challenge\", \"=\", challenge)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (!row) return null;\n\n\t\t\tconst expiresAt = new Date(row.expires_at).getTime();\n\n\t\t\t// Check expiration\n\t\t\tif (expiresAt < Date.now()) {\n\t\t\t\t// Expired, delete and return null\n\t\t\t\tawait this.delete(challenge);\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\ttype: row.type === \"registration\" ? \"registration\" : \"authentication\",\n\t\t\t\tuserId: row.user_id ?? undefined,\n\t\t\t\texpiresAt,\n\t\t\t\t...(row.data === null ? {} : { context: row.data }),\n\t\t\t};\n\t\t},\n\n\t\tasync delete(challenge: string): Promise<void> {\n\t\t\tawait db.deleteFrom(\"auth_challenges\").where(\"challenge\", \"=\", challenge).execute();\n\t\t},\n\t};\n}\n\n/**\n * Clean up expired challenges.\n * Should be called periodically (e.g., on startup, or via cron).\n */\nexport async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {\n\tconst now = new Date().toISOString();\n\n\tconst result = await db\n\t\t.deleteFrom(\"auth_challenges\")\n\t\t.where(\"expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\n\treturn Number(result.numDeletedRows ?? 0);\n}\n"],"mappings":";AAWA,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,IAAI,WAAmB,MAAoC;GAChE,MAAM,YAAY,IAAI,KAAK,KAAK,UAAU,CAAC,aAAa;AAExD,SAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;IACP;IACA,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM,KAAK,WAAW;IACtB,YAAY;IACZ,CAAC,CACD,YAAY,OACZ,GAAG,OAAO,YAAY,CAAC,YAAY;IAClC,MAAM,KAAK;IACX,SAAS,KAAK,UAAU;IACxB,MAAM,KAAK,WAAW;IACtB,YAAY;IACZ,CAAC,CACF,CACA,SAAS;;EAGZ,MAAM,IAAI,WAAkD;GAC3D,MAAM,MAAM,MAAM,GAChB,WAAW,kBAAkB,CAC7B,WAAW,CACX,MAAM,aAAa,KAAK,UAAU,CAClC,kBAAkB;AAEpB,OAAI,CAAC,IAAK,QAAO;GAEjB,MAAM,YAAY,IAAI,KAAK,IAAI,WAAW,CAAC,SAAS;AAGpD,OAAI,YAAY,KAAK,KAAK,EAAE;AAE3B,UAAM,KAAK,OAAO,UAAU;AAC5B,WAAO;;AAGR,UAAO;IACN,MAAM,IAAI,SAAS,iBAAiB,iBAAiB;IACrD,QAAQ,IAAI,WAAW;IACvB;IACA,GAAI,IAAI,SAAS,OAAO,EAAE,GAAG,EAAE,SAAS,IAAI,MAAM;IAClD;;EAGF,MAAM,OAAO,WAAkC;AAC9C,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,aAAa,KAAK,UAAU,CAAC,SAAS;;EAEpF;;;;;;AAOF,eAAsB,yBAAyB,IAAuC;CACrF,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,SAAS,MAAM,GACnB,WAAW,kBAAkB,CAC7B,MAAM,cAAc,KAAK,IAAI,CAC7B,kBAAkB;AAEpB,QAAO,OAAO,OAAO,kBAAkB,EAAE"}

package/dist/checksum-DtH6m5uk.mjs

@@ -1,162 +0,0 @@
-//#region ../registry-verification/dist/auth-B730dpJ4.js
-const UNSUPPORTED_AUTH_MESSAGE = "This release requires an authentication method the client does not support.";
-function unsupportedAuthDetails(auth) {
-	if (!isRecord(auth) || typeof auth.hint_url !== "string" || auth.hint_url.length > 2048) return;
-	try {
-		const url = new URL(auth.hint_url);
-		if (url.protocol !== "https:" || url.username || url.password) return void 0;
-		return { hintUrl: url.href };
-	} catch {
-		return;
-	}
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
-//#endregion
-//#region ../registry-verification/dist/errors-D3_zxvwe.js
-function verificationError(code, message, details) {
-	return {
-		success: false,
-		error: {
-			code,
-			message,
-			...details === void 0 ? {} : { details }
-		}
-	};
-}
-
-//#endregion
-//#region ../registry-verification/dist/checksum.js
-const SHA2_256_CODE = 18;
-const SHA2_256_LENGTH = 32;
-const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
-/** Derive the required artifact checksum from a raw sha2-256 blob CID. */
-function multihashFromBlobCid(value) {
-	if (!value.startsWith("b")) return verificationError("BLOB_REF_INVALID", "The blob reference CID is malformed.");
-	const bytes = decodeBase32(value.slice(1));
-	if (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
-	const checksum = `b${encodeBase32(bytes.slice(2))}`;
-	if (!decodeMultihash(checksum).success) return verificationError("BLOB_REF_INVALID", "Blob references must use a CIDv1 raw sha2-256 CID.");
-	return {
-		success: true,
-		value: checksum
-	};
-}
-/** Decodes a lowercase base32 multibase-encoded multihash. */
-function decodeMultihash(value) {
-	if (!value.startsWith("b")) return verificationError("INVALID_MULTIHASH", "Checksums must be lowercase base32 multibase-encoded multihashes.");
-	const bytes = decodeBase32(value.slice(1));
-	if (bytes === null) return verificationError("INVALID_MULTIHASH", "The multibase checksum is malformed.");
-	const code = readVarint(bytes, 0);
-	if (code === null) return verificationError("INVALID_MULTIHASH", "The multihash algorithm code is malformed.");
-	const length = readVarint(bytes, code.nextOffset);
-	if (length === null || length.value !== bytes.length - length.nextOffset) return verificationError("INVALID_MULTIHASH", "The multihash digest length is malformed.");
-	if (code.value !== SHA2_256_CODE) return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
-	if (length.value !== SHA2_256_LENGTH) return verificationError("INVALID_MULTIHASH", "The sha2-256 digest must be 32 bytes.");
-	return {
-		success: true,
-		value: {
-			algorithm: "sha2-256",
-			digest: bytes.slice(length.nextOffset)
-		}
-	};
-}
-async function computeArtifactDigestCandidates(bytes) {
-	const [sha256, sha384, sha512] = await Promise.all([
-		crypto.subtle.digest("SHA-256", new Uint8Array(bytes)),
-		crypto.subtle.digest("SHA-384", new Uint8Array(bytes)),
-		crypto.subtle.digest("SHA-512", new Uint8Array(bytes))
-	]);
-	return [
-		new Uint8Array(sha256),
-		new Uint8Array(sha384),
-		new Uint8Array(sha512)
-	];
-}
-async function verifyMultihash(bytes, expected) {
-	const decoded = decodeMultihash(expected);
-	if (!decoded.success) return decoded;
-	const actual = await computeDigest(bytes, decoded.value.algorithm);
-	if (!actual.success) return actual;
-	if (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError("CHECKSUM_MISMATCH", "The resource bytes do not match the expected checksum.");
-	return {
-		success: true,
-		value: true
-	};
-}
-/**
-* Compare public checksum digest bytes without early exit. Digests are public
-* integrity metadata, so a portable byte loop is preferable to a Node-only
-* timing primitive while still avoiding an ordinary equality short circuit.
-*/
-function compareDigestBytes(left, right) {
-	let difference = left.length ^ right.length;
-	const maximumLength = Math.max(left.length, right.length);
-	for (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
-	return difference === 0;
-}
-async function computeDigest(bytes, algorithm) {
-	if (algorithm !== "sha2-256") return verificationError("UNSUPPORTED_MULTIHASH", "The multihash algorithm is not supported.");
-	try {
-		return {
-			success: true,
-			value: new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)))
-		};
-	} catch {
-		return verificationError("UNSUPPORTED_MULTIHASH", "The sha2-256 algorithm is unavailable.");
-	}
-}
-function readVarint(bytes, offset) {
-	let value = 0;
-	let shift = 0;
-	for (let index = offset; index < bytes.length && index < offset + 5; index += 1) {
-		const byte = bytes[index];
-		if (byte === void 0) return null;
-		value |= (byte & 127) << shift;
-		if ((byte & 128) === 0) return {
-			value,
-			nextOffset: index + 1
-		};
-		shift += 7;
-	}
-	return null;
-}
-function encodeBase32(bytes) {
-	let result = "";
-	let buffer = 0;
-	let bits = 0;
-	for (const byte of bytes) {
-		buffer = buffer << 8 | byte;
-		bits += 8;
-		while (bits >= 5) {
-			result += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? "";
-			bits -= 5;
-		}
-	}
-	if (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? "";
-	return result;
-}
-function decodeBase32(value) {
-	if (value.length === 0) return null;
-	let buffer = 0;
-	let bits = 0;
-	const output = [];
-	for (const character of value) {
-		const digit = BASE32_ALPHABET.indexOf(character);
-		if (digit === -1) return null;
-		buffer = buffer << 5 | digit;
-		bits += 5;
-		if (bits >= 8) {
-			output.push(buffer >>> bits - 8 & 255);
-			bits -= 8;
-		}
-	}
-	if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;
-	return new Uint8Array(output);
-}
-
-//#endregion
-export { UNSUPPORTED_AUTH_MESSAGE as a, verificationError as i, multihashFromBlobCid as n, unsupportedAuthDetails as o, verifyMultihash as r, computeArtifactDigestCandidates as t };
-//# sourceMappingURL=checksum-DtH6m5uk.mjs.map

package/dist/checksum-DtH6m5uk.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"checksum-DtH6m5uk.mjs","names":[],"sources":["../../registry-verification/dist/auth-B730dpJ4.js","../../registry-verification/dist/errors-D3_zxvwe.js","../../registry-verification/dist/checksum.js"],"sourcesContent":["//#region src/auth.ts\nconst UNSUPPORTED_AUTH_MESSAGE = \"This release requires an authentication method the client does not support.\";\nfunction unsupportedAuthDetails(auth) {\n\tif (!isRecord(auth) || typeof auth.hint_url !== \"string\" || auth.hint_url.length > 2048) return;\n\ttry {\n\t\tconst url = new URL(auth.hint_url);\n\t\tif (url.protocol !== \"https:\" || url.username || url.password) return void 0;\n\t\treturn { hintUrl: url.href };\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\n//#endregion\nexport { unsupportedAuthDetails as n, UNSUPPORTED_AUTH_MESSAGE as t };\n//# sourceMappingURL=auth-B730dpJ4.js.map","//#region src/errors.ts\n/** Stable, machine-readable failures returned by this package. */\nconst VERIFICATION_ERROR_CODES = [\n\t\"AUTH_METHOD_UNSUPPORTED\",\n\t\"BLOB_METADATA_MISMATCH\",\n\t\"BLOB_REF_INVALID\",\n\t\"BUNDLE_COMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_DECOMPRESSED_SIZE_EXCEEDED\",\n\t\"BUNDLE_FILE_COUNT_EXCEEDED\",\n\t\"BUNDLE_FILE_SIZE_EXCEEDED\",\n\t\"BUNDLE_ID_MISMATCH\",\n\t\"BUNDLE_INVALID_ARCHIVE\",\n\t\"BUNDLE_INVALID_MANIFEST\",\n\t\"BUNDLE_INVALID_PATH\",\n\t\"BUNDLE_MISSING_BACKEND\",\n\t\"BUNDLE_MISSING_MANIFEST\",\n\t\"BUNDLE_PATH_COLLISION\",\n\t\"BUNDLE_UNSUPPORTED_ENTRY\",\n\t\"BUNDLE_VERSION_MISMATCH\",\n\t\"CHECKSUM_MISMATCH\",\n\t\"FETCH_FAILED\",\n\t\"HOST_REJECTED\",\n\t\"INVALID_MULTIHASH\",\n\t\"INVALID_URL\",\n\t\"PDS_RESOLUTION_FAILED\",\n\t\"PROFILE_EXTENSION_INVALID\",\n\t\"PROFILE_ID_MISMATCH\",\n\t\"PROFILE_LEXICON_INVALID\",\n\t\"PROFILE_POLICY_INVALID\",\n\t\"PROFILE_REPOSITORY_INVALID\",\n\t\"PROVENANCE_REQUIRED\",\n\t\"PROVENANCE_UNVERIFIABLE\",\n\t\"REDIRECT_LIMIT_EXCEEDED\",\n\t\"REDIRECT_LOCATION_MISSING\",\n\t\"RESOURCE_SIZE_EXCEEDED\",\n\t\"RESOURCE_STATUS_ERROR\",\n\t\"RESOURCE_TIMEOUT\",\n\t\"RELEASE_EXTENSION_INVALID\",\n\t\"RELEASE_EXTENSION_MISSING\",\n\t\"RELEASE_ARTIFACT_SOURCE_MISSING\",\n\t\"RELEASE_LEXICON_INVALID\",\n\t\"RELEASE_PACKAGE_MISMATCH\",\n\t\"RELEASE_RKEY_MISMATCH\",\n\t\"RELEASE_VERSION_INVALID\",\n\t\"RELEASE_VERSION_MISMATCH\",\n\t\"UNSUPPORTED_MULTIHASH\"\n];\nfunction verificationError(code, message, details) {\n\treturn {\n\t\tsuccess: false,\n\t\terror: {\n\t\t\tcode,\n\t\t\tmessage,\n\t\t\t...details === void 0 ? {} : { details }\n\t\t}\n\t};\n}\n\n//#endregion\nexport { verificationError as n, VERIFICATION_ERROR_CODES as t };\n//# sourceMappingURL=errors-D3_zxvwe.js.map","import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/checksum.ts\nconst SHA2_256_CODE = 18;\nconst SHA2_256_LENGTH = 32;\nconst BASE32_ALPHABET = \"abcdefghijklmnopqrstuvwxyz234567\";\n/** Derive the required artifact checksum from a raw sha2-256 blob CID. */\nfunction multihashFromBlobCid(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"BLOB_REF_INVALID\", \"The blob reference CID is malformed.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null || bytes.length !== 36 || bytes[0] !== 1 || bytes[1] !== 85) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\tconst checksum = `b${encodeBase32(bytes.slice(2))}`;\n\tif (!decodeMultihash(checksum).success) return verificationError(\"BLOB_REF_INVALID\", \"Blob references must use a CIDv1 raw sha2-256 CID.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: checksum\n\t};\n}\n/** Decodes a lowercase base32 multibase-encoded multihash. */\nfunction decodeMultihash(value) {\n\tif (!value.startsWith(\"b\")) return verificationError(\"INVALID_MULTIHASH\", \"Checksums must be lowercase base32 multibase-encoded multihashes.\");\n\tconst bytes = decodeBase32(value.slice(1));\n\tif (bytes === null) return verificationError(\"INVALID_MULTIHASH\", \"The multibase checksum is malformed.\");\n\tconst code = readVarint(bytes, 0);\n\tif (code === null) return verificationError(\"INVALID_MULTIHASH\", \"The multihash algorithm code is malformed.\");\n\tconst length = readVarint(bytes, code.nextOffset);\n\tif (length === null || length.value !== bytes.length - length.nextOffset) return verificationError(\"INVALID_MULTIHASH\", \"The multihash digest length is malformed.\");\n\tif (code.value !== SHA2_256_CODE) return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\tif (length.value !== SHA2_256_LENGTH) return verificationError(\"INVALID_MULTIHASH\", \"The sha2-256 digest must be 32 bytes.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\talgorithm: \"sha2-256\",\n\t\t\tdigest: bytes.slice(length.nextOffset)\n\t\t}\n\t};\n}\nasync function computeMultihash(bytes, algorithm = \"sha2-256\") {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)));\n\t\tconst multihash = new Uint8Array(2 + digest.length);\n\t\tmultihash[0] = SHA2_256_CODE;\n\t\tmultihash[1] = digest.length;\n\t\tmultihash.set(digest, 2);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: `b${encodeBase32(multihash)}`\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nasync function computeArtifactDigestCandidates(bytes) {\n\tconst [sha256, sha384, sha512] = await Promise.all([\n\t\tcrypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-384\", new Uint8Array(bytes)),\n\t\tcrypto.subtle.digest(\"SHA-512\", new Uint8Array(bytes))\n\t]);\n\treturn [\n\t\tnew Uint8Array(sha256),\n\t\tnew Uint8Array(sha384),\n\t\tnew Uint8Array(sha512)\n\t];\n}\nasync function verifyMultihash(bytes, expected) {\n\tconst decoded = decodeMultihash(expected);\n\tif (!decoded.success) return decoded;\n\tconst actual = await computeDigest(bytes, decoded.value.algorithm);\n\tif (!actual.success) return actual;\n\tif (!compareDigestBytes(actual.value, decoded.value.digest)) return verificationError(\"CHECKSUM_MISMATCH\", \"The resource bytes do not match the expected checksum.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: true\n\t};\n}\n/**\n* Compare public checksum digest bytes without early exit. Digests are public\n* integrity metadata, so a portable byte loop is preferable to a Node-only\n* timing primitive while still avoiding an ordinary equality short circuit.\n*/\nfunction compareDigestBytes(left, right) {\n\tlet difference = left.length ^ right.length;\n\tconst maximumLength = Math.max(left.length, right.length);\n\tfor (let index = 0; index < maximumLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);\n\treturn difference === 0;\n}\nasync function computeDigest(bytes, algorithm) {\n\tif (algorithm !== \"sha2-256\") return verificationError(\"UNSUPPORTED_MULTIHASH\", \"The multihash algorithm is not supported.\");\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new Uint8Array(bytes)))\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"UNSUPPORTED_MULTIHASH\", \"The sha2-256 algorithm is unavailable.\");\n\t}\n}\nfunction readVarint(bytes, offset) {\n\tlet value = 0;\n\tlet shift = 0;\n\tfor (let index = offset; index < bytes.length && index < offset + 5; index += 1) {\n\t\tconst byte = bytes[index];\n\t\tif (byte === void 0) return null;\n\t\tvalue |= (byte & 127) << shift;\n\t\tif ((byte & 128) === 0) return {\n\t\t\tvalue,\n\t\t\tnextOffset: index + 1\n\t\t};\n\t\tshift += 7;\n\t}\n\treturn null;\n}\nfunction encodeBase32(bytes) {\n\tlet result = \"\";\n\tlet buffer = 0;\n\tlet bits = 0;\n\tfor (const byte of bytes) {\n\t\tbuffer = buffer << 8 | byte;\n\t\tbits += 8;\n\t\twhile (bits >= 5) {\n\t\t\tresult += BASE32_ALPHABET[buffer >>> bits - 5 & 31] ?? \"\";\n\t\t\tbits -= 5;\n\t\t}\n\t}\n\tif (bits > 0) result += BASE32_ALPHABET[buffer << 5 - bits & 31] ?? \"\";\n\treturn result;\n}\nfunction decodeBase32(value) {\n\tif (value.length === 0) return null;\n\tlet buffer = 0;\n\tlet bits = 0;\n\tconst output = [];\n\tfor (const character of value) {\n\t\tconst digit = BASE32_ALPHABET.indexOf(character);\n\t\tif (digit === -1) return null;\n\t\tbuffer = buffer << 5 | digit;\n\t\tbits += 5;\n\t\tif (bits >= 8) {\n\t\t\toutput.push(buffer >>> bits - 8 & 255);\n\t\t\tbits -= 8;\n\t\t}\n\t}\n\tif (bits > 0 && (buffer & (1 << bits) - 1) !== 0) return null;\n\treturn new Uint8Array(output);\n}\n\n//#endregion\nexport { compareDigestBytes, computeArtifactDigestCandidates, computeMultihash, decodeMultihash, multihashFromBlobCid, verifyMultihash };\n//# sourceMappingURL=checksum.js.map"],"mappings":";AACA,MAAM,2BAA2B;AACjC,SAAS,uBAAuB,MAAM;AACrC,KAAI,CAAC,SAAS,KAAK,IAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAM;AACzF,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK,SAAS;AAClC,MAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,QAAO,KAAK;AAC3E,SAAO,EAAE,SAAS,IAAI,MAAM;SACrB;AACP;;;AAGF,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;;;;ACkC5E,SAAS,kBAAkB,MAAM,SAAS,SAAS;AAClD,QAAO;EACN,SAAS;EACT,OAAO;GACN;GACA;GACA,GAAG,YAAY,KAAK,IAAI,EAAE,GAAG,EAAE,SAAS;GACxC;EACD;;;;;ACpDF,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;;AAExB,SAAS,qBAAqB,OAAO;AACpC,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,oBAAoB,uCAAuC;CAChH,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,QAAQ,MAAM,WAAW,MAAM,MAAM,OAAO,KAAK,MAAM,OAAO,GAAI,QAAO,kBAAkB,oBAAoB,qDAAqD;CAClL,MAAM,WAAW,IAAI,aAAa,MAAM,MAAM,EAAE,CAAC;AACjD,KAAI,CAAC,gBAAgB,SAAS,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,qDAAqD;AAC1I,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;AAGF,SAAS,gBAAgB,OAAO;AAC/B,KAAI,CAAC,MAAM,WAAW,IAAI,CAAE,QAAO,kBAAkB,qBAAqB,oEAAoE;CAC9I,MAAM,QAAQ,aAAa,MAAM,MAAM,EAAE,CAAC;AAC1C,KAAI,UAAU,KAAM,QAAO,kBAAkB,qBAAqB,uCAAuC;CACzG,MAAM,OAAO,WAAW,OAAO,EAAE;AACjC,KAAI,SAAS,KAAM,QAAO,kBAAkB,qBAAqB,6CAA6C;CAC9G,MAAM,SAAS,WAAW,OAAO,KAAK,WAAW;AACjD,KAAI,WAAW,QAAQ,OAAO,UAAU,MAAM,SAAS,OAAO,WAAY,QAAO,kBAAkB,qBAAqB,4CAA4C;AACpK,KAAI,KAAK,UAAU,cAAe,QAAO,kBAAkB,yBAAyB,4CAA4C;AAChI,KAAI,OAAO,UAAU,gBAAiB,QAAO,kBAAkB,qBAAqB,wCAAwC;AAC5H,QAAO;EACN,SAAS;EACT,OAAO;GACN,WAAW;GACX,QAAQ,MAAM,MAAM,OAAO,WAAW;GACtC;EACD;;AAkBF,eAAe,gCAAgC,OAAO;CACrD,MAAM,CAAC,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI;EAClD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC;EACtD,CAAC;AACF,QAAO;EACN,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB,IAAI,WAAW,OAAO;EACtB;;AAEF,eAAe,gBAAgB,OAAO,UAAU;CAC/C,MAAM,UAAU,gBAAgB,SAAS;AACzC,KAAI,CAAC,QAAQ,QAAS,QAAO;CAC7B,MAAM,SAAS,MAAM,cAAc,OAAO,QAAQ,MAAM,UAAU;AAClE,KAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,KAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,MAAM,OAAO,CAAE,QAAO,kBAAkB,qBAAqB,yDAAyD;AACpK,QAAO;EACN,SAAS;EACT,OAAO;EACP;;;;;;;AAOF,SAAS,mBAAmB,MAAM,OAAO;CACxC,IAAI,aAAa,KAAK,SAAS,MAAM;CACrC,MAAM,gBAAgB,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO;AACzD,MAAK,IAAI,QAAQ,GAAG,QAAQ,eAAe,SAAS,EAAG,gBAAe,KAAK,UAAU,MAAM,MAAM,UAAU;AAC3G,QAAO,eAAe;;AAEvB,eAAe,cAAc,OAAO,WAAW;AAC9C,KAAI,cAAc,WAAY,QAAO,kBAAkB,yBAAyB,4CAA4C;AAC5H,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,MAAM,CAAC,CAAC;GACnF;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,WAAW,OAAO,QAAQ;CAClC,IAAI,QAAQ;CACZ,IAAI,QAAQ;AACZ,MAAK,IAAI,QAAQ,QAAQ,QAAQ,MAAM,UAAU,QAAQ,SAAS,GAAG,SAAS,GAAG;EAChF,MAAM,OAAO,MAAM;AACnB,MAAI,SAAS,KAAK,EAAG,QAAO;AAC5B,YAAU,OAAO,QAAQ;AACzB,OAAK,OAAO,SAAS,EAAG,QAAO;GAC9B;GACA,YAAY,QAAQ;GACpB;AACD,WAAS;;AAEV,QAAO;;AAER,SAAS,aAAa,OAAO;CAC5B,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI,OAAO;AACX,MAAK,MAAM,QAAQ,OAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,SAAO,QAAQ,GAAG;AACjB,aAAU,gBAAgB,WAAW,OAAO,IAAI,OAAO;AACvD,WAAQ;;;AAGV,KAAI,OAAO,EAAG,WAAU,gBAAgB,UAAU,IAAI,OAAO,OAAO;AACpE,QAAO;;AAER,SAAS,aAAa,OAAO;AAC5B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,IAAI,SAAS;CACb,IAAI,OAAO;CACX,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,QAAQ,gBAAgB,QAAQ,UAAU;AAChD,MAAI,UAAU,GAAI,QAAO;AACzB,WAAS,UAAU,IAAI;AACvB,UAAQ;AACR,MAAI,QAAQ,GAAG;AACd,UAAO,KAAK,WAAW,OAAO,IAAI,IAAI;AACtC,WAAQ;;;AAGV,KAAI,OAAO,MAAM,UAAU,KAAK,QAAQ,OAAO,EAAG,QAAO;AACzD,QAAO,IAAI,WAAW,OAAO"}

package/dist/chunks-zlGB5IQP.mjs

@@ -1,25 +0,0 @@
-import { u as __exportAll } from "./runner-CskI4Hmq.mjs";
-
-//#region src/utils/chunks.ts
-var chunks_exports = /* @__PURE__ */ __exportAll({
-	SQL_BATCH_SIZE: () => SQL_BATCH_SIZE,
-	chunks: () => chunks
-});
-/**
-* Split an array into chunks of at most `size` elements.
-*
-* Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's
-* bound-parameter limit (~100 per statement).
-*/
-function chunks(arr, size) {
-	if (arr.length === 0) return [];
-	const result = [];
-	for (let i = 0; i < arr.length; i += size) result.push(arr.slice(i, i + size));
-	return result;
-}
-/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */
-const SQL_BATCH_SIZE = 50;
-
-//#endregion
-export { chunks as n, chunks_exports as r, SQL_BATCH_SIZE as t };
-//# sourceMappingURL=chunks-zlGB5IQP.mjs.map

package/dist/chunks-zlGB5IQP.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunks-zlGB5IQP.mjs","names":[],"sources":["../src/utils/chunks.ts"],"sourcesContent":["/**\n * Split an array into chunks of at most `size` elements.\n *\n * Used to keep SQL `IN (?, ?, …)` clauses within Cloudflare D1's\n * bound-parameter limit (~100 per statement).\n */\nexport function chunks<T>(arr: T[], size: number): T[][] {\n\tif (arr.length === 0) return [];\n\tconst result: T[][] = [];\n\tfor (let i = 0; i < arr.length; i += size) {\n\t\tresult.push(arr.slice(i, i + size));\n\t}\n\treturn result;\n}\n\n/** Conservative default chunk size for SQL IN clauses (well within D1's limit). */\nexport const SQL_BATCH_SIZE = 50;\n"],"mappings":";;;;;;;;;;;;;AAMA,SAAgB,OAAU,KAAU,MAAqB;AACxD,KAAI,IAAI,WAAW,EAAG,QAAO,EAAE;CAC/B,MAAM,SAAgB,EAAE;AACxB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,KACpC,QAAO,KAAK,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;AAEpC,QAAO;;;AAIR,MAAa,iBAAiB"}